Search Images Maps Play YouTube News Gmail Drive More »
Sign in
Screen reader users: click this link for accessible mode. Accessible mode has the same essential features but works better with your reader.

Patents

  1. Advanced Patent Search
Publication numberUS6229894 B1
Publication typeGrant
Application numberUS 08/891,999
Publication dateMay 8, 2001
Filing dateJul 14, 1997
Priority dateJul 14, 1997
Fee statusPaid
Publication number08891999, 891999, US 6229894 B1, US 6229894B1, US-B1-6229894, US6229894 B1, US6229894B1
InventorsPaul C. Van Oorschot, Timothy E. Moses
Original AssigneeEntrust Technologies, Ltd.
Export CitationBiBTeX, EndNote, RefMan
External Links: USPTO, USPTO Assignment, Espacenet
Method and apparatus for access to user-specific encryption information
US 6229894 B1
Abstract
A method and apparatus for accessing user specific encryption information is accomplished upon receiving a request for access to user specific encryption information from a requesting entity. Based on the identity of the requesting entity and/or the type of request, a server determines the requesting entity's authorized level of access to user specific encryption information. Based on the authorized level of access, the requesting entity is provided with controlled access to the user specific information.
Images(5)
Previous page
Next page
Claims(28)
What is claimed is:
1. In a secure system that includes a server and a plurality of end-users, wherein the server stores a copy of long term decryption private keys for each of the plurality of end-users, a method for the server to process a request for access to user specific encryption information of one of the plurality of end-users, the method comprises the steps:
a) receiving, from a requesting entity, a request for access to the user specific encryption information, wherein the requesting entity includes at least one of: one of the plurality of end-users, a system administrator of the secure system, and a third party not affiliated with the secure system;
b) determining authorized level of access of the requesting entity to the user specific encryption information based on at least one of identity of the requesting entity and the request; and
c) providing the requesting entity with controlled access to the user specific encryption information based on the authorized level of access.
2. The method for claim 1 further comprises:
generating an encryption public key certificate and a distinct signature public key certificate for an end-user of the plurality of users;
storing, by the server, the long term decryption private key corresponding to the encryption public key certificate of the end-user; and
automatically, from time to time, updating the encryption public key certificate and, independently over time, the distinct signature public key certificate.
3. The method of claim 1, wherein, when the requesting entity is the one of the plurality end-users, step (b) further comprises determining the level of access of the one of the plurality of end-users to be receipt of at least one long term decryption key; and wherein step (c) further comprises providing the at least one long term decryption private key to the one of the plurality of end-users.
4. The method of claim 1, wherein, when the requesting entity is the system administrator of the secure system, step (b) further comprises determining the level of access of the system administrator to be receipt of at least one long term description key, and wherein step (c) further comprises providing the at least one long term decryption private key to at least one of: the one of the plurality of end-users and the system administrator.
5. The method of claim 1, wherein, when the requesting entity is the third party not affiliated with the secure system, step (b) further comprises determining the level of access of the third party to be receipt of at least one long term decryption key of the one of the plurality of end-users; and wherein step (c) further comprises providing the long term decryption private key of the one of the plurality of end-users users, wherein the providing is done via at least one of an online communication and a store-and-forward communication.
6. The method of claim 1, wherein, when the requesting entity is the third party not affiliated with the secure system, step (b) further comprises determining the level of access of the third party to be receipt of a session key of a particular communication of the one of the plurality of end-users; and wherein step (c) further comprises providing the session key of a particular communication of the one of the plurality of end-users, wherein the particular communication is at least one of an online communication and a store-and-forward communication.
7. The method of claim 6 further comprises:
providing a symmetric key encrypted using a public key of the one of the plurality of end-users as the session key, wherein the symmetric key is provided to the requesting entity as at least one of: clear symmetric key, encrypted session key using a public key of the requesting entity, and encrypted using a unique symmetric key that is known by the server and the requesting entity.
8. The method of claim 1, wherein, when the requesting entity is the third party not affiliated with the secure system, step (b) further comprises determining the level of access of the third party to be receipt of plain text of a particular communication of the one of the plurality of end-users; and wherein step (c) further comprises providing the plain text of a particular communication of the one of the plurality of end-users when the third party provided ciphertext with a wrapped key, wherein the providing is done via at least one of an online communication and a store-and-forward communication.
9. The method of claim 1 further comprises:
receiving the request from a third party, wherein the request is requesting the user specific encryption information for a specific period of time;
interpreting time stamp information that has been embedded in encrypted communications of the one of the plurality of end-users; and
providing the third party with the controlled access to the user specific encryption information for encrypted communications that occur within the specific period of time.
10. In a secure system that includes a server and a plurality of end-users, wherein the server stores a copy of long term decryption private keys for each of the plurality of end-users, a method for the server to recover user specific encrypted information of one of the plurality of end-users, the method comprises the steps of:
a) receiving, from a requesting entity, a request for recovery of the user specific encrypted information, wherein the request is requesting the user specific encryption information for a specific period of time, and wherein the requesting entity includes at least one of: one of the plurality of end-users, a system administrator of the secure system, and a third party not affiliated with the secure system;
b) determining authorized level of access to the user specific encrypted information based on at least one of: identity of the requesting entity and the request;
c) interpreting time stamp information that has been embedded in encrypted communications of the one of the plurality of end-users; and
d) providing the requesting entity controlled access to the user specific encryption information for encrypted communications that occur within the specific period of time, wherein the controlled access is based on the authorized level of access.
11. The method of claim 10 further comprises providing a session key for at least one of the encrypted communications that occurred within the specific period of time.
12. The method of claim 10 further comprises providing plain text of at least one of the encrypted communications that occurred within the specific period of time when the requesting entity has provided a ciphertext version and a wrapped key of the at least one of the encrypted communications.
13. A server comprising:
a processing device;
first memory for storing a copy of long term decryption private keys for each of a plurality of end-users; and
second memory that stores programming instructions that, when read by the processing device, causes the processing device to (a) receive, from a requesting entity, a request for access to the user specific encryption information, wherein the requesting entity includes at least one of: one of the plurality of end-users, a system administrator of the secure system, and a third party not affiliated with the secure system; (b) determine authorized level of access of the requesting entity to the user specific encryption information based on at least one of identity of the requesting entity and the request; and (c) provide the requesting entity with controlled access to the user specific encryption information based on the authorized level of access.
14. The server of claim 13 further comprises, within the memory, programming instructions that, when read by the processing device, causes the processing device to provide at least one long term decryption private key to the one of the plurality of end-users when the requesting entity is the one of the plurality end-users.
15. The server of claim 13 further comprises, within the memory, programming instructions that, when read by the processing device, causes the processing device to provide a long term decryption private key of the one of the plurality of end-users when the requesting entity is a third party not affiliated with the secure system.
16. The server of claim 13 further comprises, within the memory, programming instructions that, when read by the processing device, causes the processing device to provide a session key of a particular communication of the one of the plurality of end-users when the requesting entity is a third party not affiliated with the secure system.
17. The server of claim 16 further comprises, within the memory, programming instructions that, when read by the processing device, causes the processing device to provide a symmetric key encrypted under a public key of the one of the plurality of end-users as the session key, wherein the symmetric key is provided to the requesting entity as at least one of: clear symmetric key, encrypted session key using a public key of the requesting entity, and encrypted using a unique symmetric key that is known by the server and the requesting entity.
18. The server of claim 13 further comprises, within the memory, programming instructions that, when read by the processing device, causes the processing device to provide plain text of a particular communication of the one of the plurality of end-users when the requesting entity is a third party not affiliated with the secure system when the requesting entity has provided ciphertext with a wrapped key.
19. The server of claim 13 further comprises, within the memory, programming instructions that, when read by the processing device, causes the processing device to:
receive the request from a third party, wherein the request is requesting the user specific encryption information for a specific duration of time;
interpret time stamp information that has been embedded in encrypted communications of the one of the plurality of end-users; and
provide the third party with the controlled access to the user specific encryption information for encrypted communications that occur within the specific duration of time.
20. The server of claim 13 further comprises, within the memory, programming instructions that, when read by the processing device, causes the processing device to generate an encryption public key certificate and a distinct signature public key certificate for an end-user of the plurality of users, and automatically, from time to time, update the encryption public key certificate and the distinct signature public key certificate.
21. The server of claim 13 further comprises, within the memory, programming instructions that, when read by the processing device, causes the processing device to provide a long term decryption private key of the one of the plurality of end-users when the requesting entity is a system administrator.
22. A digital storage medium that stores programming instructions that, when read by a processing device, causes the processing device to recover user specific encrypted information in a secure system, the digital storage medium comprises:
first means for storing programming instructions that, when read by the processing device, causes the processing device to receive, from a requesting entity, a request for access to the user specific encrypted information, wherein the requesting entity includes at least one of: one of the plurality of end-users, a system administrator of the secure system, and a third party not affiliated with the secure system;
second means for storing programming instructions that, when read by the processing device, causes the processing device to determine authorized level of access of the requesting entity to the user specific encryption information based on at least one of identity of the requesting entity and the request; and
third means for storing programming instructions that, when read by the processing device, causes the processing device to provide the requesting entity with controlled access to the user specific encryption information based on the authorized level of access.
23. The digital storage medium of claim 22 further comprises programming instructions that, when read by the processing device, causes the processing device to provide at least one long term decryption private key to the one of the plurality of end-users when the requesting entity is the one of the plurality end-users.
24. The digital storage medium of claim 22 further comprises programming instructions that, when read by the processing device, causes the processing device to provide a long term decryption private key of the one of the plurality of end-users when the requesting entity is a third party not affiliated with the secure system.
25. The digital storage medium of claim 22 further comprises programming instructions that, when read by the processing device, causes the processing device to provide a session key of a particular communication of the one of the plurality of end-users when the requesting entity is a third party not affiliated with the secure system.
26. The digital storage medium of claim 25 further comprises programming instructions that, when read by the processing device, causes the processing device to provide a symmetric key encrypted under a public key of the one of the plurality of end-users as the session key.
27. The digital storage medium of claim 22 further comprises programming instructions that, when read by the processing device, causes the processing device to provide plain text of a particular communication of the one of the plurality of end-users when the requesting entity is a third party not affiliated with the secure system and when the requesting entity has provided ciphertext.
28. The digital storage medium of claim 22 further comprises programming instructions that, when read by the processing device, causes the processing device to:
receive the request from a third party, wherein the request is requesting the user specific encryption information for a specific duration of time;
interpret time stamp information that has been embedded in encrypted communications of the one of the plurality of end-users; and
provide the third party with the controlled access to the user specific encryption information for encrypted communications that occur within the specific duration of time.
Description
TECHNICAL FIELD OF THE INVENTION

This invention relates generally to encryption and more particularly to recovering. or accessing, user-specific encryption information.

BACKGROUND OF THE INVENTION

Secure transmission of data is known to include encrypting the data using an encryption algorithm and an associated encryption key. The encrypted data is then sent to a receiving party who, based on the encryption key and a corresponding decryption algorithm, decrypts the encrypted data to recapture the original data. Such an encryption algorithm and corresponding decryption algorithm may be the widely used Data encryption standard (“DES”), which utilizes a symmetric key.

An issue with the use of symmetric keys arises in getting the key securely from the sending party to the receiving party. One rather effective technique is to encrypt the symmetric key (which is sometimes referred to as a session key) using an encryption public key of the receiving party. Thus, the sending party can prepare an encrypted message by encrypting the symmetric key with the receiving party, or parties, public key and encrypting the message and/or data using the symmetric key. When the receiving party, or parties, receives the encrypted message, the receiving party decrypts the symmetric key using its private decryption key. Once the receiving party has recovered the symmetric key, it can decrypt the encrypted message and/or data. In addition, the sending party may address itself as a virtual recipient by including a copy of the symmetric key encrypted under the sending party's public key such that the sending party may subsequently access the encrypted message.

In a typical commercial application, a public-private key pair is valid for an extended period of time (E.g., one year or longer). Under the valid key pair, a user may accumulate a very large number of files (and/or e-mail messages or EDI [electronic data interchange]), each having a distinct symmetric key. If the user's private decryption key (which is sometimes referred to as a long term private key) is lost, the user is unable to decrypt any of these files and/or e-mail messages securely. To safeguard against the loss of a user's private decryption key, it is customary to store the key on a hardware token, such as a smart card or a PCMCIA Card (“PC Card”), or in a software file encrypted under an encryption key (or “pass key”) derived from the user's password and other additional information.

Despite such safeguards, access to a user's private decryption key is sometimes lost (E.g., token is lost or destroyed, user forgot the password, file corruption). As such, additional safeguards have been implemented. One such implementation is to have an organization store a back-up copy of the private decryption key for each user in a secured. centralized server. Such an organization should be entitled to recover the key. For example the organization could be the users' employer. Thus, when a user loses his/her private decryption key, the user makes a request of the organization to restore his/her private decryption key. The request typically involves authentication and identification information. The organization verifies the user based on the authentication and identification information and subsequently provides, in a secure manner, the private decryption key to the user.

While the organization may provide satisfactory recovery of lost keys in the commercial setting described above, it might not adequately meet the needs of third parties, such as law enforcement agencies. The centralized organization solution fails to meet law enforcement agencies' needs because these agencies typically want to monitor, via wire-tap warrants, communications of a user without notice to the user and/or the organization. Typically, the law enforcement agency will capture encrypted communications to and from a targeted user. However, without the private decryption key or session key, the law enforcement agency is unable to read the files. Thus, to obtain access to the plain text files, the organization, or the user, would have to provide the key, thus removing the anonymity of the wire-tapping.

To provide law enforcement agencies the stealth they desire while performing a wire-tap, a Key Recovery Agent (KRA) was developed and added to secure systems. A KRA is a trusted third-party which has its own private/public key pair. Each legitimate user of the secure system has a copy of the KRA's public key and uses it to encrypt a copy of the session key for the KRA, and include this in a message header, as an additional virtual recipient. If a law enforcement official then sends the header portion of the message to the KRA, the KRA is then able to recover the session key using its private decryption key. The session key may then be given to properly authorized law enforcement officials who, assuming they are also in possession of the corresponding ciphertext, can use the session key to recover the plain text message.

While the KRA works well for third-party needs to access a particular communication, it does not work well in the commercial setting where a particular user may have a hundred or more files that have been encrypted based on its public encryption key. To recover the session key for each communication, the user has to make individual requests to the KRA for the respective session keys, which is a cumbersome process. Further, the KRA does not restore the private decryption key to the user, thus, for incoming encrypted messages, the user would have to make individual requests to the KRA for the session keys of these new messages. This, obviously, is impractical for commercial use.

Therefore, a need exists for a method and apparatus that allows for controlled access of user specific encryption information that is acceptable to law enforcement agencies and is acceptable to meet the commercial requirements of the private sector.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a schematic block diagram of a system that incorporates the present invention;

FIG. 2 illustrates a graphical representation of encrypted data flow which is in accordance with the present invention;

FIG. 3 illustrates a logic diagram which may be used to access user-specific encryption information in accordance with the present invention;

FIG. 4 illustrates a logic diagram which may be used to access user specific encryption information in accordance with the present invention; and

FIG. 5 illustrates a logic diagram which may be used to access user specific encryption information in accordance with the present invention.

DETAILED DESCRIPTION OF THE DRAWINGS

Generally, the present invention provides a method and apparatus for accessing user specific encryption information. This may be accomplished upon receiving a request for access to user specific encryption information from a requesting entity. Based on the identity of the requesting entity and/or the type of request, a server determines the requesting entity's authorized level of access to user specific encryption information. Based on the level of access, the requesting entity is provided with controlled access to the user specific information. With such a method and apparatus, the present invention provides a technique for recovering lost (E.g., forgotten, destroyed, or otherwise inaccessible) private decryption keys to end-users in a commercially feasible manner and also for providing controlled access to third parties to user specific information that meets both the commercial sector's and law enforcement agencies' needs.

The present invention can be more fully described with reference to FIGS. 1 through 5. FIG. 1 illustrates a schematic block diagram of a system 10 that incorporates the present invention. As shown, the system 10 includes a network 12, a first area network which may be local or wide, a second area network which may be local or wide, and a third-party 34. The first area network includes a server 14, a plurality of end-users 18-22, and a system administrator 24. The second area network includes a plurality of end-users 26-32 and a server 16. Note that the second area network may further include a system administrator. Further note that the function of the first and second area networks is substantially equivalent, thus, only one area network will be discussed. Still further note that the germane functionality of the present invention is the same regardless of whether the first and second area networks are local area networks and/or wide area networks.

As shown, the plurality of end-users 18-22 are coupled to the system administrator, the server 14, and the network 12 via the first area network. Each of the end-users 18-22 may be personal computers, main frame computers, work stations, personal digital assistants (PDA), or any device that processes digital information wherein such processing is required to be at least partially done in a secure manner. In addition, each of the end-users are equipped with at least one symmetric encryption algorithm, such as DES, and has an asymmetric public/private key pair and an asymmetric (public key) algorithm. As such, when an end-user is transmitting secured data to a receiving party, the sending party encrypts a symmetric key using the public encryption key of the receiving party, or recipient end-user. The sending end-user encrypts the message using the symmetric key and transmits the encrypted message and encrypted session key to the recipient end-users, where the recipient end-users may include the sending end-user (Note that by including the sending end-user, it allows the sender to secure locally stored files which might be done without addressing any other recipients). Upon receipt of the encrypted data, the recipient end-user utilizes its private decryption key to decrypt the session key and uses the recovered session key to decrypt the message.

The system administrator 24 may be a personal computer, a work station, a main frame computer, a network computer, or any other processing device that is capable of manipulating digital information based on programming instructions. The system administrator 24 has its own private decryption key and a public encryption key, such that it may communicate securely with any one of the end-users in the secure system 10. In operation, the system administrator 24 maintains a record of each end-user affiliated with its security domain which may be any subset of user within a local area network, wide area network, or a world-wide network. The system administrator 24 further maintains end-user information such as end-user identification, access privileges, etc. and other system information. The system administrator 24 further functions to control the addition or deletion of end-users to the security domain.

The server 14, which may be personal computer, a work station, a main frame computer, or any other processing device that is capable of manipulating digital information based on programming instructions, maintains encryption public key certificates 36, signature public key certificates 38, and private decryption keys 40 for each of the end-users in the particular secured system. The server 14 may store this information directly or within a database, which may be referred to as a directory. An encryption public key certificate includes the identity of a particular end-user, the public encryption key for the particular end-user, additional information as may be necessary, and the signature of the server. A signature key certificate includes the identity of a particular end-user, the signature verification key of this end-user, and the signature of the server. The encryption public key certificate and the signature key certificate will be discussed in greater detail with reference to FIG. 2, below.

In operation, the server 14 provides the encryption certificate 36 of an end-user(s) to a sending end-user. The sending end-user utilizes the public encryption key of the receiving end-user(s) to prepare a wrapped session key for each of the recipients, i.e., a symmetric key encrypted using the public encryption key of each receiving end-user. The sending end-user then encrypts a message and/or file using the symmetric key and transmits both the wrapped key and the encrypted message to the receiving end-user(s). Upon receipt of the encrypted message, the receiving end-user decrypts the wrapped session key using its private decryption key and then decrypts the encrypted message using the recovered symmetric key.

In addition to providing the encrypted message and wrapped key, the sending end-user may transmit its signature for this message to the receiving end-users. The receiving end-users, via the signature key certificate 38 of the sending end-user, verifies the signature of the sending party. Thus, two security services are provided; one via the public encryption and private decryption key pair and the second via the signature and verification key pair.

The server 14 also provides controlled access to user specific encryption information of each of the end-users affiliated with the security domain. For example, server 14 provides controlled access to the user specific encryption information of end-users 18-22, while server 16 provides controlled access to user specific encryption information of end-users 26-32. Such user specific encryption information includes, but is not limited to, the private decryption key, session keys for particular encrypted communications, and plain text conversion of ciphertext, i.e., the ordinary text of a file or message encrypted via a session key. As one skilled in the art will readily appreciate, the private decryption keys 40 of the end-users may be stored within the server utilizing any appropriate local encryption techniques.

The server 14 controls access to the user specific encryption information based on the identity of the requesting entity and/or the type of request. For example, the third-party 34 may request access to the private decryption key 40 for a particular end-user. If the third-party 34 is a law enforcement official authorized to wire-tap the particular end-user and requesting the private decryption key of the particular end-user, the server 14 may provide the third party with the particular end-user's private decryption key. Alternatively, the server may restrict access to the private decryption key for a specified period, or may grant access to session keys for specific communications of the particular end-user upon presentation of the corresponding wrapped session key.

If the request from the third party was to provide plain text of ciphertext communications, the server 14 would, upon being presented with a copy of the encrypted communication including the associated wrapped session key, decrypt the communications and provide the third party with the plain text. If, however, the requesting party is the particular end-user who may have lost access to his/her own private keys, the server 14 would provide it with the private decryption key, or a history of private decryption keys and there would be no need for presenting encrypted communications along with the request. Recall that private decryption keys may be updated on a periodic basis, such as once per year. If the particular end-user has old messages, i.e., over a year old and encrypted using a different public encryption and private decryption key pair, the end-user would want to retrieve the old private decryption key such that it could decrypt old messages. Thus, a history of private decryption keys may be provided. As one skilled in the art will readily appreciate, the controlled access provided by the server 14 will depend on local, state, and federal laws, agreements the system administrator has with local governmental agencies, agreements with the end-users, etc.

FIG. 2 illustrates a graphical representation of encrypted data flow in the secure system of FIG. 1. In this example, the sending end-user 18 desires to encrypt data 50 and provide it to end-users A 20 and B 22. To begin the encryption process the sending end-user 18 requests, and subsequently receives, an end-user encryption certificate of end-users and another one for end-user B from server 16. The end-user encryption certificate of end-user A or B 60 includes the public encryption key of the particular end-user 62, the end-user's identity, and the signature of the server 64 on this certificate data.

Upon receiving this information, the sending end-user 18 verifies the signature of the server 64. Such a verification is done using a verification algorithm and the public key of the server. Once the signature of the server has been verified to be valid, the sending end-user 18 knows that the public encryption keys 62 for end-users A and/or B are valid. Having valid public encryption keys for the targeted end-users A and B, the sending end-user 18 generates and encrypts a symmetric key based on the public encryption keys of end-users A and B to produce two wrapped session keys. A wrapped session key is also created using the encryption public key of the sending end-user 18, for reasons as explained below. As one skilled in the art will readily appreciate, the sending end-user 18 needs to generate a unique wrapped session key for each of the receiving end-users, but only one copy of the encrypted file or message 58 will only be encrypted using the symmetric key.

Having generated the wrapped session keys 52 and the encrypted file or message 58, the sending end-user 18 includes its signature 56 in an encrypted transmission 54 and transmits it to the receiving end-users 20 and 22. Note a copy of the session key is also wrapped under the encryption public key of the sending end-user 18. This is done for several reasons: One of which enables the sending end-user 18 to keep a record of the encryption transmissions 54 that it generates. Another reason is for the law enforcement agencies. If the sending end-user 18 did not make a wrapped key for itself a requesting third party 34 making a request regarding an end-user 18, associated with server 14, would only be able to access inbound transmissions, since they are encrypted with the receiving end-users' public encryption key and the third party might only have access to the server 14 of the sending unit 18. But outgoing message are encrypted using the public encryption key of the receiving end-users, thus, by including the sending end-user as a receiving end-user, a third party 34 making a request on the server 14, to which end-user 18 is affiliated, would be able to access outbound transmissions of the sending end-user 18.

Upon receiving the encrypted transmission, each of the receiving end-users 20 and 22 retrieves their respective private decryption keys 74 and 76. The end-users 20 and 22 typically will store their own private decryption keys either in a hardware format or a software format. If an end-user has lost its private decryption key, it may retrieve it from the server 16. As mentioned, the server 16 may store the private decryption keys 74 and 76 in secure hardware, or in software using an encryption algorithm and a local cryptographic key of the server 16.

Having retrieved their private decryption keys 74 and 76, the receiving end-users 20 and 22 decrypt the wrapped session key 52 to recapture the symmetric key. Having recaptured the symmetric key, the receiving end-users 20 and 22 decrypt the encrypted file or message 58. As one skilled in the art will readily appreciate, the communication of the encrypted transmission 54 may be done over an online protocol or using a store-and-forward communication protocol. An online protocol is one that has a low-latency bi-directional connection between the sending end-user and the receiving end-users, while a store-and-forward communication protocol does not have a bi-directional connection between the sending and receiving end-users and the latency may be high

If the end-users desire to verify the signature of the sending end-user 56. The receiving end-users 20 and 22 further receive an end-user verification certificate 78. Note that this certificate 78 may be appended to the encrypted message by the sending end-user or it may be retrieved from the directory (as shown in FIG. 2) by each recipient end-user. The end-user verification certificate includes end-user identity, a public verification key of the sending end-user 80 and the signature of the server 82. Upon verifying the signature of server 82, the receiving end-users 20 and 22 know that the public verification key of sending end-user 80 is authentic. Having the public verification key of the sending end-user, the signature of the sending end-user 56 may be verified.

As is further shown in FIG. 2, the server 16 is coupled to a directory 68. The directory 68 may be a data base which stores the end-user encryption certificates 70 (and, optionally, end-user signature certificates 72) for each of the plurality of end-users in the secure system 10. An end-user encryption certificate 60 includes the public encryption key 62 of one end-user and the signature of the server 64. The end-user verification certificate 78 includes a public signature verification key 80 for one end-user and the signature of the server 82. As previously mentioned, the private decryption key and the private signature key of an end-user is updated on a periodic basis (E.g. once per year). As such, the end-user encryption certificate 60 and the end-user verification certificate 78 must be updated as well.

To update the end-user encryption certificate 60, the end-user system first determines that it is time to update its encryption certificate. Having made this determination, the end-user provides a decryption key update request to the server. Upon receiving the request, the server generates a new private decryption key and a public encryption key for the requesting end-user. Alternatively, the end-user system may generate the encryption key pair and securely transmit the decryption private key and the encryption public key to the server. The server 16 then securely provides the new private decryption key to the end-user. Next, the server 16 generates and publishes the new public encryption key in the directory as an updated end-user encryption certificate.

When updating the end-user signature certificate for a particular end-user, the end-user system generates a new signature key pair and provides the public key (i.e., the signature verification key) to the server. The server 16 then generates the signature verification certificate, which includes the new verification public key of the requesting end-user.

If the server 16 receives a request for access to user specific encryption information from a requesting entity, the server 16, via a processing device 90 (and, optionally, with the assistance of a human operator acting at a server user interface), would execute programming instructions stored in memory 92; such programming instructions may be for any one, or all, of the processes illustrated in FIGS. 3 through 5. The processing device 90 may be a micro-computer, micro-controller, micro-processor, personal computer, work station, or any device that manipulates digital information based on programming instructions. The memory may be RAM, ROM, CD ROM, hard drive, floppy disk, and magnetic tape memory, or any means for storing digital information

Upon receiving the request, the server 16 would determine the identity of the requesting entity and the type of access being requested. From this information, the server 16 would determine the requesting entity's authorized level of access to the user specific encryption information and provide the requesting entity with controlled access to the encryption information based on the authorized level of access. For example, if the requesting entity is the end-user, the server 16, upon verifying the end-user's identity, would provide the end-user system with the end-user's own private decryption key or a history of decryption keys.

As an alternative example, if the requesting entity is a third party, the server 16 would determine whether the particular third party has any access rights to the user specific encryption information. If not, the server would deny the third party's request. If, however, the third party does have access privileges to the user specific encryption information, the server would determine to what degree. For example, the third party may be granted access to the end-user's private decryption key or key history such that it can decrypt any messages received by or transmitted by the end-user at any point in the past or until the next key update. Alternatively, access to the end-user's private decryption key may be limited to a specific period of time. As another alternative, the third party may be granted access to certain session keys for particular communications. As yet another alternative, the third party may be granted access, not to keying material but rather to the plain text corresponding to ciphertext (accompanied by the appropriate wrapped session keys) which the third party provided.

The lower-right portion of FIG. 2 illustrates the software process of retrieving an end-user's private decryption key 90 using a decryption process 84 which utilizes a password 86 to decrypt an encrypted private decryption key 88. The encrypted private key 88 may be the decryption private key 74, 76, provided by server 16. If the end-user forgets his or her password or its record of the private key becomes lost or destroyed, then the user's copy of the private decryption key 90 is lost. Once the private key is lost the user is no longer able to decrypt stored or incoming messages. This, therefore, provides a need for the present invention, which allows the end-user to recover its private decryption keys.

FIG. 3 illustrates a logic diagram which may be used to request access to user specific encryption information. The process begins at step 100 where a request to access user-specific encryption information is received from a requesting entity. The request may be requesting access to the user-specific encryption information such as a private decryption key of a particular end-user, a session key for a particular communication, or clear text from captured ciphertext, while the requesting entity may be a third-party, the particular end-user, or the system administrator. Note that a third-party, which may be a law enforcement agency, is not affiliated with the secure system in that it is not involved in the normal operations of the system nor is it an end-user or the system administrator.

Upon receiving the request to access user-specific encryption information, the process proceeds to step 102 where a determination is made as to the authorized level of access the requesting entity has to the information. Such a determination is based on the identity of the requesting entity and/or the details/contents of the request. For example, if the requesting entity is the end-user and the request is to recover its private decryption key history, the server would grant the request. Alternatively, when the requesting entity is a third-party, the request may be to access the private key, access a particular session key for a particular communication, or to obtain clear text of a ciphertext document. Depending on whether the third party has authorization for such a request, the server may or may not grant the request. As one skilled in the art will readily appreciate, the granting of a request and the resulting level of access provided by the server 14 will depend on local, state, and federal laws, agreements the system administrator has with local governmental agencies, agreements with the end-users, etc.

Having determined the level of access, the process proceeds to step 104 where the requesting entity is provided with controlled access to the user's specific encryption information. Such controlled access limits the requesting entity's access to the user-specific encryption information. For example, if the requesting entity is a third-party, the requesting entity might not be provided with the private decryption key but only a session key for a particular communication that fell within a particular time period. By limiting the access of third parties to user specific encryption information, the commercial sector's need for limiting third-party's access to sensitive data is obtained. In addition a third-party's need to obtain access to particular information (E.g., in accordance with a legal warrant) is achieved. Thus, the present invention provides a method and apparatus that substantially meet the needs of both governmental agencies and the private sector regarding secured data transmissions. Moreover, this need is met without the introduction of additional infrastructure, such as a third party KRA, which introduces additional business costs and complexities.

FIG. 4 illustrates a logic diagram that may be used to obtain access to user specific encryption information. The process begins at step 110 where a request for access to user-specific encryption information is received from a requesting entity. The requests, in addition to specifying the identity of the requesting entity and the type of request, also specifies a specific duration of time that access to the user-specific encryption information is being requested. Upon receiving the request, the process proceeds to step 112 where a determination is made as to the requesting entity's level of access to the user specific encryption information. Such a determination is based on the identity of the requesting entity and/or the particular request.

Having made such a determination, the process proceeds to step 116 where time-stamped information embedded in encrypted communication of the end-user is interpreted. This step assumes that encrypted communications include time-stamped information. As is generally understood in the art, reliable time stamping of information is dependent on an accurate clock source and that the time stamp be embedded in the communication in a trustworthy manner, i.e., one which precludes subsequent manipulation or modification by an unauthorized party. Thus, the secure system 10 would require access to an accurate clock source such as the global positioning satellite system or a dedicated clock for the system.

Having interpreted time-stamped information, the process proceeds to step 118 where a determination is made as to whether all the encrypted communications being requested occurred during the specific duration of time. If yes, the process proceeds to step 120 where controlled access is provided to the encrypted communications, where such controlled access is based on the level of access.

If, however, all of the communications do not occur within the specific period of time, the process proceeds to step 122. At step 122, a determination is made as to whether any of the communications occurred within the specific time duration. If not, the process proceeds to step 126 where access is denied to the user specific encryption information. If, however, some of the communications occurred within the specific period of time, the process proceeds to step 124. At step 124, controlled access is provided to the encryption communications that are within the specific period of time. Such control access is based on the authorized level of access. As one skilled in the art will readily appreciate, a third-party, such as a law enforcement official may request access to a particular end-user's encrypted communications that will occur in the future. Such a future requests, which are typically obtained via a warrant, would indicate the particular specific period of time. The process of FIG. 4 would accommodate such future communications by providing the appropriate wrapped session keys.

FIG. 5 illustrates a logic diagram for obtaining access to user specific encryption information. The process begins at step 130 where the server generates an encryption public/private key pair, a public key certificate, and a distinct signature public key certificate for at least one end-user. Such encryption public key certificates and signature public key certificates were discussed previously with reference to FIG. 2. The process then proceeds to step 132 where, from time to time, the server automatically updates and securely transmits to the user, either by online or store-and-forward communication, the encryption public key pair, the distinct public key certificate, and/or the distinct signature public key certificate. This too was discussed with reference to FIG. 2.

The process then proceeds to step 134 where a determination is made as to whether a request for access to user-specific encryption information has been received. If not, the process waits until such a request is received. Once a request is received, the process proceeds to step 136 where a determination is made as to whether the requesting entity is the end-user, a third-party, or the system administrator.

If the requesting entity is the end-user, the process proceeds to step 138 where the end-user is provided with at least one long-term private decryption key. The end-user may further be provided with a history of long-term private decryption keys such that, if the user has stored encrypted messages that pre-date the current decryption private key, the user may decrypt such old messages. If, the requesting entity is the system administrator, the process proceeds to step 140. At step 140, the system administrator is provided with access to at least one long-term decryption private key of the end-user. Similarly, the system administrator may be provided with a history of decryption private keys for the end-user.

If, however, the requesting entity is a third-party, the process proceeds to step 142 where a determination is made as to whether the level of access of the third-party enables the third-party to access the long-term decryption private key. If so, the process proceeds to step 150 where the third-party is provided with access to the long-term decryption private key. As one skilled in the art will readily appreciate, when the third-party has the long-term decryption private key, the third-party may decrypt any communication using a session key that was wrapped using the public key associated with the private key. To allow decryption of information transmitted from the end-user, the end-user system is designed to include a wrapped session key for itself such that it is a recipient of its encrypted messages. This is reflected in FIG. 2.

If, however, the third-party is not allowed to access the long-term decryption private key, the process proceeds to step 144 where a determination is made as to whether the request is requesting access to a session key. If yes and such access is authorized, the process proceeds to step 148 where the third-party is provided with access to the session key for a particular communication where the ciphertext (or simply the wrapped key) corresponding to this communication is provided by the third party to the server. Such a particular communication may be an online communication or a store-and-forward communication. If, however, the request was not for access to a session key but for decryption of ciphertext, the process proceeds to step 146. At step 146, if such a request by this third party is authorized, the third-party is provided with plain text of a particular communication when the third-party has provided ciphertext and a wrapped key for the particular communication.

The preceding discussion has presented a method and apparatus for a secure system to substantially meet the needs of the private sector and third parties, such as governmental agencies. By controlling access to user-specific encryption information, third-party entities, which may be law enforcement officials, can obtain authorized access to encrypted data of a particular end-user while the private sector can be assured that the third-party access is limited and within the controls of a commercial organization as authorized by a legal warrant. In addition, the third-party may obtain access to the user-specific encryption information only from a specific period of time, where requests for access to communications outside the period of time will be denied by the server of the secured system. Further, the present invention allows end-users to restore their private decryption keys and/or key histories without the burdens of the KRA system.

Patent Citations
Cited PatentFiling datePublication dateApplicantTitle
US5163096 *Jun 6, 1991Nov 10, 1992International Business Machines CorporationStorage protection utilizing public storage key control
US5436972 *Oct 4, 1993Jul 25, 1995Fischer; Addison M.Method for preventing inadvertent betrayal by a trustee of escrowed digital secrets
US5481613 *Apr 15, 1994Jan 2, 1996Northern Telecom LimitedComputer network cryptographic key distribution system
US5557346 *Aug 11, 1994Sep 17, 1996Trusted Information Systems, Inc.System and method for key escrow encryption
US5557765 *Feb 21, 1995Sep 17, 1996Trusted Information Systems, Inc.System and method for data recovery
US5606617 *Oct 14, 1994Feb 25, 1997Brands; Stefanus A.Secret-key certificates
US5633928 *Mar 10, 1995May 27, 1997Bell Communications Research, Inc.Key escrow method with warrant bounds
US5640454 *Sep 12, 1996Jun 17, 1997Trusted Information Systems, Inc.System and method for access field verification
Referenced by
Citing PatentFiling datePublication dateApplicantTitle
US6591095 *May 19, 2000Jul 8, 2003Motorola, Inc.Method and apparatus for designating administrative responsibilities in a mobile communications device
US6651171 *Apr 6, 1999Nov 18, 2003Microsoft CorporationSecure execution of program code
US6742120 *Dec 15, 1998May 25, 2004Mondex International LimitedSystem and method for controlling access to computer code in an IC card
US6757824Dec 10, 1999Jun 29, 2004Microsoft CorporationClient-side boot domains and boot rules
US6775779Apr 6, 1999Aug 10, 2004Microsoft CorporationHierarchical trusted code for content protection in computers
US6853988 *Sep 20, 2000Feb 8, 2005Security First CorporationCryptographic server with provisions for interoperability between cryptographic systems
US6938164Nov 22, 2000Aug 30, 2005Microsoft CorporationMethod and system for allowing code to be securely initialized in a computer
US6976175Dec 13, 2004Dec 13, 2005Microsoft CorporationHierarchical trusted code for content protection in computers
US6978365Dec 16, 2004Dec 20, 2005Microsoft CorporationClient-side boot domains and boot rules
US6986059Jun 17, 2004Jan 10, 2006Microsoft CorporationHierarchical trusted code for content protection in computers
US7010684Jul 14, 2003Mar 7, 2006Microsoft CorporationMethod and apparatus for authenticating an open system application to a portable IC device
US7020772Sep 22, 2003Mar 28, 2006Microsoft CorporationSecure execution of program code
US7073057 *Dec 4, 2001Jul 4, 2006Entrust LimitedMethod and apparatus for obtaining status of public key certificate updates
US7088823 *Jan 9, 2002Aug 8, 2006International Business Machines CorporationSystem and method for secure distribution and evaluation of compressed digital information
US7107463Aug 18, 2005Sep 12, 2006Microsoft CorporationManifest-based trusted agent management in a trusted operating system environment
US7137004Nov 16, 2001Nov 14, 2006Microsoft CorporationManifest-based trusted agent management in a trusted operating system environment
US7139915Oct 19, 2005Nov 21, 2006Microsoft CorporationMethod and apparatus for authenticating an open system application to a portable IC device
US7159240Nov 16, 2001Jan 2, 2007Microsoft CorporationOperating system upgrades in a trusted operating system environment
US7174021 *Jun 28, 2002Feb 6, 2007Microsoft CorporationSystems and methods for providing secure server key operations
US7174457Mar 10, 1999Feb 6, 2007Microsoft CorporationSystem and method for authenticating an operating system to a central processing unit, providing the CPU/OS with secure storage, and authenticating the CPU/OS to a third party
US7194092Jan 8, 1999Mar 20, 2007Microsoft CorporationKey-based secure storage
US7243230Nov 16, 2001Jul 10, 2007Microsoft CorporationTransferring application secrets in a trusted operating system environment
US7257707Aug 18, 2005Aug 14, 2007Microsoft CorporationManifest-based trusted agent management in a trusted operating system environment
US7260724Sep 20, 2000Aug 21, 2007Security First CorporationContext sensitive dynamic authentication in a cryptographic system
US7302709Sep 7, 2005Nov 27, 2007Microsoft CorporationKey-based secure storage
US7305553Aug 18, 2005Dec 4, 2007Microsoft CorporationManifest-based trusted agent management in a trusted operating system environment
US7305706Jan 15, 2004Dec 4, 2007Cisco Technology, Inc.Establishing a virtual private network for a road warrior
US7356682May 7, 2003Apr 8, 2008Microsoft CorporationAttesting to a value of a register and/or memory region
US7391865Jun 11, 2003Jun 24, 2008Security First CorporationSecure data parser method and system
US7424606May 7, 2003Sep 9, 2008Microsoft CorporationSystem and method for authenticating an operating system
US7434056Feb 20, 2002Oct 7, 2008Lg Electronics Inc.Watermark-based copy management system and method for digital media copy protection
US7434263May 7, 2003Oct 7, 2008Microsoft CorporationSystem and method for secure storage data using a key
US7443985Aug 23, 2006Oct 28, 2008Microsoft CorporationSystems and methods for providing secure server key operations
US7454508 *Jan 15, 2003Nov 18, 2008Microsoft CorporationConsent mechanism for online entities
US7457412Dec 22, 2006Nov 25, 2008Microsoft CorporationSystem and method for authenticating an operating system to a central processing unit, providing the CPU/OS with secure storage, and authenticating the CPU/OS to a third party
US7487365Apr 4, 2003Feb 3, 2009Microsoft CorporationSaving and retrieving data based on symmetric key encryption
US7496769Dec 20, 2004Feb 24, 2009Microsoft CorporationHierarchical trusted code for content protection in computers
US7506376Feb 4, 2002Mar 17, 2009Lg Electronics Inc.Copy protection method for digital media
US7509682 *Feb 4, 2002Mar 24, 2009Lg Electronics Inc.Copy protection method and system for digital media
US7512786Apr 6, 2004Mar 31, 2009Microsoft CorporationClient-side boot domains and boot rules
US7529919May 7, 2003May 5, 2009Microsoft CorporationBoot blocks for software
US7533162Apr 10, 2003May 12, 2009Thomson LicensingMethod, apparatus and system for supporting multiple collaborative sessions in a bi-directional communication device
US7543335Feb 25, 2005Jun 2, 2009Microsoft CorporationMethod and system for allowing code to be securely initialized in a computer
US7543336May 7, 2003Jun 2, 2009Microsoft CorporationSystem and method for secure storage of data using public and private keys
US7548152 *Oct 8, 2004Jun 16, 2009Entrust LimitedRFID transponder information security methods systems and devices
US7577839Feb 28, 2005Aug 18, 2009Microsoft CorporationTransferring application secrets in a trusted operating system environment
US7577840Feb 28, 2005Aug 18, 2009Microsoft CorporationTransferring application secrets in a trusted operating system environment
US7634661Aug 18, 2005Dec 15, 2009Microsoft CorporationManifest-based trusted agent management in a trusted operating system environment
US7653815Jun 12, 2002Jan 26, 2010Research In Motion LimitedSystem and method for processing encoded messages for exchange with a mobile data communication device
US7669116 *Mar 26, 2002Feb 23, 2010Accenture Global Services, GmbhSingle access point for filing of converted electronic forms to multiple processing entities
US7697717Apr 18, 2006Apr 13, 2010Lg Electronics Inc.Method of embedding watermark into digital image
US7711120Jul 29, 2005May 4, 2010Infoassure, Inc.Cryptographic key management
US7715565Jul 29, 2005May 11, 2010Infoassure, Inc.Information-centric security
US7721341Jun 15, 2005May 18, 2010Microsoft CorporationMethod and system for allowing code to be securely initialized in a computer
US7739501Jul 29, 2005Jun 15, 2010Infoassure, Inc.Cryptographic key construct
US7760904May 2, 2006Jul 20, 2010Lg Electronics Inc.Proprietary watermark system for secure digital media and content distribution
US7802104Aug 16, 2007Sep 21, 2010Security First CorporationContext sensitive dynamic authentication in a cryptographic system
US7814161Jun 23, 2006Oct 12, 2010Research In Motion LimitedSystem and method for handling electronic mail mismatches
US7821926Aug 31, 2007Oct 26, 2010Sonicwall, Inc.Generalized policy server
US7827406Mar 25, 2005Nov 2, 2010Research In Motion LimitedSystem and method for processing encoded messages for exchange with a mobile data communication device
US7840207Nov 30, 2005Nov 23, 2010Research In Motion LimitedDisplay of secure messages on a mobile communication device
US7877813Jul 26, 2007Jan 25, 2011Lg Electronics Inc.Copy protection method and system for digital media
US7890771Apr 4, 2003Feb 15, 2011Microsoft CorporationSaving and retrieving data based on public key encryption
US7912856 *Oct 29, 2007Mar 22, 2011Sonicwall, Inc.Adaptive encryption
US7913310 *Mar 13, 2003Mar 22, 2011Sia WhitecryptionDevice for protecting against unauthorized use of software
US7925889 *Aug 21, 2003Apr 12, 2011Verint Americas Inc.Method and system for communications monitoring
US7949355Sep 4, 2007May 24, 2011Research In Motion LimitedSystem and method for processing attachments to messages sent to a mobile device
US7953971Oct 27, 2005May 31, 2011Research In Motion LimitedSynchronizing certificates between a device and server
US8009830Nov 20, 2006Aug 30, 2011Security First CorporationSecure data parser method and system
US8015400Jun 9, 2009Sep 6, 2011Research In Motion LimitedCertificate management and transfer system and method
US8019081Aug 6, 2002Sep 13, 2011Research In Motion LimitedSystem and method for processing encoded messages
US8099595Apr 21, 2011Jan 17, 2012Research In Motion LimitedSynchronizing certificates between a device and server
US8135134Sep 12, 2008Mar 13, 2012Security First Corp.Systems and methods for managing cryptographic keys
US8155322Nov 7, 2007Apr 10, 2012Security First Corp.Systems and methods for distributing and securing data
US8191105Nov 18, 2005May 29, 2012Research In Motion LimitedSystem and method for handling electronic messages
US8195128Apr 19, 2011Jun 5, 2012Research In Motion LimitedSystem and method for processing attachments to messages sent to a mobile device
US8205084Jan 12, 2010Jun 19, 2012Research In Motion LimitedSystem and method for processing encoded messages for exchange with a mobile data communication device
US8209530Dec 22, 2009Jun 26, 2012Research In Motion LimitedSystem and method for searching and retrieving certificates
US8214650Sep 9, 2010Jul 3, 2012Security First CorporationContext sensitive dynamic authentication in a cryptographic system
US8254582Sep 24, 2007Aug 28, 2012Research In Motion LimitedSystem and method for controlling message attachment handling functions on a mobile device
US8266438Oct 25, 2005Sep 11, 2012Security First Corp.Secure data parser method and system
US8271802Feb 10, 2012Sep 18, 2012Security First Corp.Secure data parser method and system
US8291212Jan 21, 2010Oct 16, 2012Research In Motion LimitedSystem and method for compressing secure E-mail for exchange with a mobile data communication device
US8296829Mar 17, 2009Oct 23, 2012Research In Motion LimitedProviding certificate matching in a system and method for searching and retrieving certificates
US8300831Apr 26, 2010Oct 30, 2012International Business Machines CorporationRedundant key server encryption environment
US8312165Oct 1, 2010Nov 13, 2012Research In Motion LimitedSystem and method for handling electronic mail mismatches
US8315601Apr 30, 2012Nov 20, 2012Research In Motion LimitedSystem and method for processing attachments to messages sent to a mobile device
US8320560Jun 29, 2011Nov 27, 2012Security First CorporationSecure data parser method and system
US8332638Feb 17, 2012Dec 11, 2012Security First Corp.Secure data parser method and system
US8355701Nov 15, 2010Jan 15, 2013Research In Motion LimitedDisplay of secure messages on a mobile communication device
US8392818Feb 18, 2010Mar 5, 2013Accenture Global Services LimitedSingle access point for filing of converted electronic forms to multiple processing entities
US8447980Jan 25, 2010May 21, 2013Research In Motion LimitedSystem and method for processing encoded messages for exchange with a mobile data communication device
US8473561Nov 8, 2012Jun 25, 2013Research In Motion LimitedSystem and method for handling electronic mail mismatches
US8473756Jan 7, 2009Jun 25, 2013Security First Corp.Systems and methods for securing data using multi-factor or keyed dispersal
US8494170 *Apr 23, 2012Jul 23, 2013International Business Machines CorporationRedundant key server encryption environment
US8527767Nov 1, 2010Sep 3, 2013Blackberry LimitedSystem and method for processing encoded messages for exchange with a mobile data communication device
US8539226Sep 1, 2011Sep 17, 2013Blackberry LimitedCertificate management and transfer system and method
US8561158Sep 13, 2012Oct 15, 2013Blackberry LimitedProviding certificate matching in a system and method for searching and retrieving certificates
US8566582May 30, 2012Oct 22, 2013Blackberry LimitedSystem and method for searching and retrieving certificates
US8572389Dec 22, 2005Oct 29, 2013Blackberry LimitedSystem and method for protecting master encryption keys
US8589677Dec 13, 2011Nov 19, 2013Blackberry LimitedSystem and method for retrieving related certificates
US8589701 *Jan 27, 2011Nov 19, 2013Microsoft CorporationSaving and retrieving data based on public key encryption
US8601498May 27, 2011Dec 3, 2013Security First Corp.Accelerator system for use with secure data storage
US8611936Sep 14, 2012Dec 17, 2013Blackberry LimitedDisplay of secure messages on a mobile communication device
US8621243Jan 27, 2011Dec 31, 2013Microsoft CorporationSaving and retrieving data based on public key encryption
US8645684Dec 9, 2011Feb 4, 2014Blackberry LimitedSynchronizing certificates between a device and server
US8650434Mar 31, 2011Feb 11, 2014Security First Corp.Systems and methods for securing data in motion
US8654971May 19, 2010Feb 18, 2014Security First Corp.Systems and methods for securing data in the cloud
US8656167Feb 23, 2009Feb 18, 2014Security First Corp.Systems and methods for secure workgroup management and communication
US8661267Sep 9, 2011Feb 25, 2014Blackberry LimitedSystem and method for processing encoded messages
US20110119502 *Jan 27, 2011May 19, 2011Microsoft CorporationSaving and retrieving data based on public key encryption
US20120233455 *Apr 23, 2012Sep 13, 2012International Business Machines CorporationRedundant key server encryption envionment
CN1322431C *Apr 17, 2003Jun 20, 2007微软公司Encryption retention and data retrieve based on symmetric cipher key
CN1554176BJul 10, 2002Dec 5, 2012捷讯研究有限公司Method for processing encrypted message in wireless mobile communication device and device for processing multiple access for encrypted contents
CN1647449BApr 10, 2003Jan 26, 2011汤姆森许可公司Method, apparatus and system for supporting multiple collaborative sessions in a bi-directional communication device
EP1284570A2 *Aug 13, 2002Feb 19, 2003Research In Motion LimitedSystem and method for pushing encrypted information between a host system and a mobile data communication device
EP1300747A1 *Oct 4, 2001Apr 9, 2003MSG Software SARLMethod for appending plurality of digital signatures to an electronic document on-line
EP1715649A2 *Aug 13, 2002Oct 25, 2006Research In Motion LimitedSystem and method for pushing encrypted information between a host system and a mobile data communication device
EP1715650A2 *Aug 13, 2002Oct 25, 2006Research In Motion LimitedSystem and method for pushing encrypted information between a host system and a mobile data communication device
WO2003007570A1 *Jul 10, 2002Jan 23, 2003Research In Motion LtdSystem and method for secure message key caching in a mobile communication device
WO2003090405A1 *Apr 10, 2003Oct 30, 2003Thomson Licensing SaMethod, apparatus and system for supporting multiple collaborative sessions in a bi-directional communication device
WO2005029292A1 *Sep 23, 2004Mar 31, 2005Accenture Global Services GmbhServer-based digital signature
WO2005045550A2 *Oct 29, 2004May 19, 2005Becrypt LtdPassword recovery system and method
WO2012039703A1 *Sep 21, 2010Mar 29, 2012Hewlett-Packard Development Company, L.P.Providing differential access to a digital document
Classifications
U.S. Classification713/150, 713/189, 709/229
International ClassificationG06F21/00
Cooperative ClassificationG06F2211/008, G06F21/6209, G06F2221/2107
European ClassificationG06F21/62A
Legal Events
DateCodeEventDescription
Jan 20, 2014ASAssignment
Owner name: ENTRUST HOLDINGS, INC., TEXAS
Effective date: 20131231
Owner name: ENTRUST, INC., TEXAS
Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:WELLS FARGO CAPITAL FINANCE, LLC;REEL/FRAME:032089/0151
Owner name: ORION SECURITY SOLUTIONS, INC., VIRGINIA
Jan 17, 2014ASAssignment
Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:GOLUB CAPITAL LLC;REEL/FRAME:032086/0638
Effective date: 20131231
Owner name: ORION SECURITY SOLUTIONS, INC., VIRGINIA
Owner name: ENTRUST HOLDINGS, INC., TEXAS
Owner name: ENTRUST, INC., TEXAS
Sep 28, 2012FPAYFee payment
Year of fee payment: 12
Jul 30, 2009ASAssignment
Owner name: WELLS FARGO FOOTHILL, LLC, CALIFORNIA
Free format text: PATENT SECURITY AGREEMENT;ASSIGNORS:HAC HOLDINGS, INC.;HAC ACQUISITION CORPORATION;ENTRUST, INC.;AND OTHERS;REEL/FRAME:023015/0782
Effective date: 20090728
Owner name: WELLS FARGO FOOTHILL, LLC,CALIFORNIA
Free format text: PATENT SECURITY AGREEMENT;ASSIGNORS:HAC HOLDINGS, INC.;HAC ACQUISITION CORPORATION;ENTRUST, INC. AND OTHERS;US-ASSIGNMENT DATABASE UPDATED:20100323;REEL/FRAME:23015/782
Free format text: PATENT SECURITY AGREEMENT;ASSIGNORS:HAC HOLDINGS, INC.;HAC ACQUISITION CORPORATION;ENTRUST, INC. AND OTHERS;US-ASSIGNMENT DATABASE UPDATED:20100406;REEL/FRAME:23015/782
Free format text: PATENT SECURITY AGREEMENT;ASSIGNORS:HAC HOLDINGS, INC.;HAC ACQUISITION CORPORATION;ENTRUST, INC. AND OTHERS;REEL/FRAME:23015/782
Jun 5, 2009ASAssignment
Owner name: ENTRUST, INC., TEXAS
Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE ASSIGNEE INADVERTENTLY LISTED INCORRECTLY ON THE ORIGINAL ASSIGNMENT PREVIOUSLY RECORDED ON REEL 009119 FRAME 0340;ASSIGNORS:VAN OORSCHOT, PAUL;MOSES, TIMOTHY E.;REEL/FRAME:022783/0744
Effective date: 19970710
Sep 18, 2008FPAYFee payment
Year of fee payment: 8
Sep 29, 2004FPAYFee payment
Year of fee payment: 4
Apr 13, 1998ASAssignment
Owner name: ENTRUST TECHNOLOGIES LTD., CANADA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:VAN OORSCHOT, PAUL;MOSES, TIMOTHY E.;REEL/FRAME:009119/0340
Effective date: 19970710